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REMARKS 

The Examiner has objected to the Abstract Applicant has clarified the abstract to 
avoid such objection. 

The Examiner has rejected Claims 12 and 27 under 35 U.S.C. 1 12, second 
paragraph, as being indefinite. Applicant has cancelled such claims in order to render 
such rejection moot. 

The Examiner has rejected Claims 1-11, 13-14, 16-26, 28-29, 31-33, 35, 38, 41- 
42, 44, 47 and 50 under 35 U.S.C. 102(e) as being anticipated by Maher, III et aL (U.S. 
Patent No. 6,381,242). Applicant respectfully disagrees with such rejection, especially in 
view of the amendments made hereinabove to each of the independent claims. 

With respect to independent Claims 1 and 1 6, the Examiner has relied on the 
following excerpts from Maher to make a prior art showing of applicant's claimed 
"network interface passively monitoring a transient packet stream at a network boundary" 
(see the same or similar, but not identical language in each of the foregoing claims). 

'Network apparatus loo accepts data from the line by means of 
input physical interface 102. Input physical interface 102 can 
consist of a plurality of ports, and can accept any number of 
network speeds and protocols, including such high speeds as oc-3, 
OC-12, OC-48, and protocols including 10/100 Ethernet, gigabit 
Ethernet, and SONET. Input physical interface 102 takes the data 
from the physical ports, frames the data, and then formats the 
data_" (Col. 5, lines 46- 54 -emphasis added) 

"QoS processor 116 is operable to perform the traffic flow 
management for the stream of data packets processed by network 
apparatus 100." (Col. 7, lines 13-15-emphasis added) 

Applicant respectfully asserts that such excerpts do not meet applicant's specific 
claim language. In particular, Maher teaches taking data from physical ports, framing the 
data, and formatting the data along with a processor that performs traffic flow 
management (see emphasized excerpts above). Clearly, acting on data, as described in 
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Maher, does not meet applicant's claimed "passively monitoring a transient packet stream 
at a network boundary." 

Still with respect to independent Claims 1 and 16, the Examiner has relied on the 
following excerpt from Maher to make a prior art showing of applicant's claimed "packet 
receiver reassembling one or more of the incoming datagrams into a segment structured 
in compliance with a transport protocol layer* (see the same or similar, but not identical, 
language in each of the foregoing claims). 

n The data is first sent to header preprocessor 104, which is 
operable to perform several operations using information 
contained in the data packet headers. Header preprocessor 104 
stores the received data packets in packet storage memory 106 and 
scans the header information. The header information is scanned 
to identify the type, or protocol , of the data packet, which is 
used to determine routing information and to decode the IP header 
starting byte. As will be discussed below, network apparatus ioo, 
in order to function properly, needs to reorder out of order data 
packets and reassemble data paekafc fragments. " (Col. 5, line 50- 
col. 6, line 4) 

Applicant respectfully asserts that such excerpt generally teaches that the network 
apparatus <c need[s] to reorder out of order data packets and reassemble data packet 
fragments" (see emphasized excerpt). However, such excerpt does not teach that the 
"one or more datagrams [are reassembled] into a segment structured in compliance with a 
transport layer protocol, " as specifically claimed by applicant (emphasis added). 

With respect to independent Claims 32 and 41, the Examiner has relied on the 
same rejections with respect to independent Claim 1 to meet applicant's claim language. 
However, applicant notes that the excerpts in Maher relied by the Examiner fail to 
disclose any sort of "receiving copies of datagrams/' let alone "into an incoming packet 
queue " as claimed by applicant (emphasis added), 

Also with respect to independent Claims 32 and 41, the Examiner has again relied 
on Col. 5, line 60-CoL 6, line 4 in Maher to make a prior art showing of applicant's 
claimed "packet receiver reassembling one or raoxe such datagrams from the incoming 
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packet queue into network protocol packets, each staged in a reassembled packet queue" 
(see the same or similar, but not identical, language in each of the foregoing claims). 
However, applicant again notes that such excerpt does not specifically teach 
Reassembling one or more such datagrams. . .into network protocol packets, " as claimed 
by applicant (emphasis added), In addition, nowhere in the Maher reference is there any 
disclosure of staging each reassembled datagram "in a reassembled packet queue/ * in the 
manna: specifically claimed by applicant. 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
single prior art reference. Verdegaal Bros, v. Union Oil Co. Of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). Moreover, the identical invention must be 
shown in as complete detail as contained in the claim. Richardson v. Suzuki Motor 
Co.868 R2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. Cir. 1989), The elements must be 
arranged as required by the claim. 

This criterion has simply not been met by the Maher reference, as noted above. 
Nevertheless, despite such paramount deficiencies and in the spirit of expediting the 
prosecution of the present application, applicant has substantially, but not identically, 
incorporated the subject matter of Claim 1 1 into each of the independent claims. 

With respect to Claim 1 1 et aL, substantially incorporated into each of the 
independent claims, the Examiner has relied on CoL 7, lines 1 8-30 in Maher to make a 
prior art showing of applicant's claimed "protocol-specific module processing each 
reassembled datagram based on the transport protocol layer employed by the reassembled 
datagram" (see the same or similar, but not identical language in each of the independent 
claims). Applicant respectfully asserts that such excerpt teaches "assigning] the data 
packet to one of [the Qos processor's] internal quality of service queues 132 based on the 
conclusion [of the header preprocessor and/or the content processor] 
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In addition, the only protocol mentioned in the context of the Maher excerpt relied 
on by the Examiner relates to a protocol of a data packet (see Col. 5, lines 65-66). 
Clearly, simply assigning a packet to a queue and/or determining a protocol of a data 
packet, as in Maher, does meet applicant's claimed specific claim language, namely 
"processing each reassembled datagram based on the transport p rotocol layer employed 
by the reassembled datagram" (emphasis added - see Claims 1 and 16) and plurality of 
protocol-specific modules process each reassembled datagram based on an upper protocol 
layer employed by the reassembled datagram" (see Claims 32 and 41). 

Since the Maher reference fails to meet each element in applicant's claims, as 
noted above, a notice of allowance or a specific prior art showing of each of the 
foregoing claimed features, in combination with the remaining claimed features, is 
respectfully requested. 

Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. For example, with respect to Claim 3 et al., the Examiner has relied on 
Col. 5, line 65-CoL 6, line 1 to make a prior art showing of applicant's claimed 44 network 
protocol-specific decoder [that] decod[es} the reassembled segment prior to scanning." 
Applicant respectfully asserts that such excerpt merely teaches decoding the IP header 
starting bvte, and NOT the reassembled segment as specifically claimed by applicant. In 
addition, the IP header starting byte is decoded before being sent to the content processor, 
which reassembles the data packet (see Col. 6, lines 8-12), and NOT decoding the already 
reassembled segment prior to scannings in the manner claimed by applicant. 

With respect to Claim 4 et al., the Examiner has relied on Col. 7, lines 30-33 in 
Maher to make a prior art showing of applicant's claimed technique '"wherein the 
antivirus scanner terminates the transient packet stream if the reassembled segment is not 
infected with at least one of a computer virus and malware." Applicant respectfully 
asserts that such excerpt, however, teaches selectively discarding "[i]nforaiation in 
queues that do not have the available bandwidth to transmit all the data currently residing 
in the queue." Clearly, discarding information based on an available bandwidth, as in 
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Maher, does not meet any sort of ^eiminat[ing] the transient packet stream if the 
reassembled segment is not infected with at least one of a computer vims and malware," 
as claimed by applicant (emphasis added). 

Also, with respect to Claim 6 et al„ the Examiner has relied on CoL 10, lines 42- 
46 in Maher to make a prior art showing of applicant's claimed technique "wherein the 
action comprises at least one of logging an infection; generating a warning; spoofing a 
valid datagram in place of the infected datagram; and acquiescing to the infection." 
Applicant respectfully asserts that such excerpt in Maher only teaches that "the content 
processor can act to alter the bits of [an] infected attachment essentially rendering the 
email harmless" (emphasis added). Clearly, altering the bits of an infected attachment 
does not meet applicant's specific claim language, namely "logging an infection; 
generating a warning; spoofing a valid datagram in place of the infected datagram; and 
acquiescing to the infection." 

Again, a notice of allowance or a specific prior art showing of all of applicant's 
claim limitations, in combination with the remaining claim elements, is respectfully 
requested. 

Still yet, applicant brings to Ae Examiner's attention the subject matter of new 
Claims 51-55 below, which are added for full consideration: 

"wherein the network protocol packets employ at least one of HTTP, FTP, 
SMTP, POP3, NNTP, and Gnutella network protocols" (see Claim 5 1); 

'Svherein only datagrams compliant with IP protocol are reassembled" 
(see Claim 52); 

"wherein the antivirus scanner Includes a plurality of protocol-specific 
scanning submodules, each protocol-specific scanning submodule designated for 
scanning network protocol packets of a particular protocol" (see Claim 53); 
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"wherein the protocol-specific submodules include an HTTP submodule, 
an FTP submodule, an SMTP submodule, and an NNTP submodule" (see Claim 
54); and 

"wherein the incoming datagrams include IP datagrams tl>flt are 
reassembled into TCP segments" (see Claim 55), 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims, 

Reconsideration is respectfully requested. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NA11P393/0U62.O1). 
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